Tutti

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:58 AM UTC
• Version: 1.1.0

Overview

This skill appears purpose-built for multi-agent coding orchestration, but it exposes high-impact actions such as running workflows, spawning agents, applying handoffs, and landing code without strong confirmation or scoping guidance.

Install only if you intentionally want Codex/OpenClaw to manage Tutti agents for a trusted repository. Review tutti.toml first, treat handoff packets as sensitive, and require explicit human approval before run_workflow, apply_handoff, land_agent --force, land_agent --pr, or any workflow that runs shell commands or pushes code.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill exposes substantial operational capabilities through shell execution, environment access, and file reads, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission makes it easier for an invoking agent to use broader capabilities than a reviewer or user may expect, reducing transparency and increasing the chance of unsafe workspace or system actions.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The handoff features describe generating and applying context packets between agents without warning that these packets may contain sensitive code, credentials, proprietary context, or other workspace data. Because the skill is specifically designed to propagate context across multiple agents and worktrees, it increases the risk of inadvertent disclosure or wider spread of sensitive information.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs agents to run workflows, execute commands, verify, and land branches back to the main branch or open PRs, but it does not prominently warn that these actions can modify the workspace, repository history, or remote state. In a multi-agent orchestration context, that missing warning is more dangerous because users may trigger large, automated changes across several worktrees or branches without understanding the blast radius.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Several actions are explicitly state-changing or potentially destructive, including launching/stopping teams, running workflows, applying handoffs, and landing branches with force/PR options, yet the manifest provides no user-facing warning or confirmation expectations. Because this skill orchestrates coding agents and repository operations, silent or poorly signposted execution could lead to code changes, branch merges, process disruption, or propagation of unsafe prompts with limited operator awareness.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_tt(action: str, tt_bin: list[str], args: list[str], expect_json: bool) -> CommandResult:
    cmd = [*tt_bin, *args]
    try:
        proc = subprocess.run(cmd, text=True, capture_output=True, check=False)
    except FileNotFoundError:
        return CommandResult(
            ok=False,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Vague Triggers

Low

• Confidence: 91% confidence
• Finding: The manifest exposes many broad orchestration actions such as launching agents, sending arbitrary prompts, running workflows, applying handoffs, and landing branches, but it does not define activation constraints, allowed contexts, or exclusion guidance. In an agentic environment this increases the chance of unsafe invocation, prompt-driven misuse, or unintended state changes because the caller is not warned when these actions should be restricted.

Static analysis

No suspicious patterns detected.